I'm getting spam e-mail...from myself?

SMTP messages have a host of header values that are used by mail servers (Qmail) and mail clients (Outlook, Gmail) for different things. It's possible your email was set as either the From or the Sender value which was displayed by your mail client.

Here's some info on SMTP from and sender headers: http://tools.ietf.org/html/rfc4021#section-2.1.2

As for your questions...

Question 1: No idea. Getting emails from yourself isn't a guarantee that your account was compromised.

Question 2: If I were a spammer I would look for ways to confuse digital and organic anti-spam systems. You could imagine anti-spam filters that automatically whitelist emails that come from the account holder and you can imagine people that get curious about messages that look like they came from themselves. Those types of messages might be more likely to slip past spam filters and get clicked.

If you want to know more about the message you can investigate the mail headers. That will show you the sender, the from, the return-path. You should also be able to see what server your mail server received the message from so that might be a clue.

You could also look in your Sent mail folder. If someone did compromise your account and send you mail and forgot to hide their tracks, you might see a copy of the message in there. If you do find a copy in your Sent folder, that's a pretty strong indicator that something is wrong...


You didn't specify, so I assumed it was a bounce message. If so, there are two possible options here:

a) The spammer sent spam using your address as the reply-to. This is called Backscatter, and it's pretty common.

b) The email is actually spam, disguised as a bounce message. People are more likely to open bounce messages than they are undisguised spam, so this technique is sometimes used. This is called Deliberate Bounce.

This topic is dealt with more deeply here: https://blog.malwarebytes.org/online-security/2015/11/backscatter-or-misdirected-bounces/